Loading story…
REvil/Sodinokibi continued to evolve its ransomware toolkit with updated encryption and execution features aimed at improving impact on victim environments. Analysis of version 2.2 showed the malware restored persistence through the Windows Run registry key when configured to do so and added use of the Windows Restart Manager to identify processes and services locking targeted files, then terminate those processes or stop and delete services so encryption can proceed. Researchers also noted the malware can remove a critical-process protection flag before killing a process, potentially destabilizing infected systems, while retaining familiar behaviors such as shadow copy deletion, process termination, ransom note deployment, wallpaper changes, and encrypted configuration parsing.
Separate reporting tied REvil to a broader set of delivery and targeting methods across Windows, Linux, and enterprise infrastructure. A PowerShell-based loader was observed disabling AMSI, decrypting an embedded payload, and using in-memory shellcode injection to launch REvil without writing the final executable directly to disk. Earlier technical analysis described phishing-delivered JavaScript loaders, PowerShell staging, UAC bypass, optional exploitation of CVE-2018-8453, and process hollowing, while additional reporting and indicators linked the group to Linux ransomware samples and exploitation of Oracle WebLogic Server vulnerabilities for initial access. Together, the references show an operation refining both its post-compromise encryption logic and its initial access and execution tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
An AlienVault OTX pulse for a Linux version of REvil was created and modified on June 28, 2021. The pulse published indicators for the Linux variant, including a YARA rule named REvilLinux and multiple ELF hashes.
SANS ISC analyzed a malicious PowerShell sample that used RunSpaces, an AMSI bypass, and shellcode-based loading to deploy REvil/Sodinokibi ransomware. The researcher concluded the actors' delivery method had shifted to a PowerShell RunSpace and shellcode-based loader.
Intel 471 states that REvil ransomware version 2.1 was first collected on March 15, 2020. The same source notes version 2.1 had removed the Run registry key persistence mechanism.
Cisco Talos published reporting on Sodinokibi ransomware exploiting a WebLogic Server vulnerability. This marks an early public report tying the ransomware to WebLogic-based intrusion activity.
A Panda Security report states that Sodinokibi, also known as REvil, first appeared in attacks on April 26, 2019. The report describes it as a ransomware-as-a-service operation.
Intel 471 analyzed REvil ransomware version 2.2 and reported that it restored Run-key persistence removed in version 2.1. The update also added Windows Restart Manager-based process and service termination and a new -silent command-line option.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
intel471.com
Open sourceotx.alienvault.com
Open sourceisc.sans.edu
Open sourceblog.talosintelligence.com
Open sourcecrowdstrike.com
Open sourcepandasecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
**Sodinokibi**, also known as **REvil** and **BlueCrab**, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen **RDP** access, and exploitation of vulnerabilities including `CVE-2019-2725`, `CVE-2018-13379`, and `CVE-2019-11510`. In South Korea, attackers also abused vulnerable WordPress sites for **SEO poisoning**, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader. The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete **Volume Shadow Copies** before encryption. IBM described the group’s use of **Curve25519**, **ECDH**, **Salsa20**, **AES**, and **SHA-3** in its encryption workflow, as well as its **double-extortion** model of stealing data and threatening publication on **The Happy Blog**. The ransomware was linked to a broad affiliate ecosystem, represented **22%** of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Aug 14, 2026
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026